WASHINGTON — The Federal Reserve has embarked on a multipronged effort to alert financial institutions about the threat of synthetic identity fraud, which has already cost lenders an estimated $6 billion in losses and drained resources from the Paycheck Protection Program.
Some analysts say fraud committed by creating fake personas is now the fastest-growing crime in the U.S. However, defining and identifying synthetic identity fraud has proved challenging for risk managers and law enforcement that historically have been more focused on stopping fraud from more traditional identity theft.
After publishing three white papers on the topic, the Fed in September launched a focus group of 12 industry experts to agree on a standard definition for synthetic identity fraud. In April, the group
The idea is to focus bankers' efforts on flagging instances of fraud that are distinct from the more garden-variety instances of when a person steals another's identity. One common approach by synthetic fraudsters is to create a fake persona with a made-up name and address that are combined with someone's actual social security number, often stolen through a data breach.
“It's a fantastic first step,” Greg Woolf, a member of the working group and CEO of the fraud detection software provider FiVerity, said of the standardized effort to define synthetic identity fraud. “The definition is a start, and as this unfolds, the Fed is looking to educate the market and implement this in a way that will help the financial industry.”
Growth in criminals committing synthetic identity fraud began to catch the attention of Fed officials in 2018, said Jim Cunha, senior vice president for secure payments at the Federal Reserve Bank of Boston.
“Synthetic identity came in as something that appeared to be growing dramatically,” he said. “We felt like this was an area where the Fed, as a leader catalyst, could provide value.”
Although there is scant and varying data on synthetic identity fraud, the associated losses for banks are generally expected to climb. Aite Group has estimated that by 2023, synthetic identity fraud could account for $2.42 billion in unsecured credit losses, up from approximately $1.63 billion in 2019.
Officials said part of the Fed's aim is to highlight the risk of fraudsters creating fake businesses, instead of just fake individuals, that then try to apply for credit.
“Our definition is sort of precise, in that it talks about personally identifiable information, and it talks about an individual and an entity,” said Mike Timoney, vice president of secure payments at the Boston Fed. “Most of what we saw in original definitions was really focused around an identity, but it really didn't take into the side that it could be a business or an entity that actually has a fake identity as well.”
The Fed's definition helped move synthetic identity fraud from an “amorphous concept” to something concrete, said Jason Kratovil, the executive director of the Consumer First Coalition.
“Even those who knew about it and were paying attention to it and trying to do things to stop it were not defining and approaching it and looking for it the same way,” he said. “If everybody is tilting at slightly different windmills, you are collectively not going to do a very good job at combating the problem.”
Some of the more recent high-profile cases of synthetic identity fraud involved bad actors creating fake businesses to steal from the PPP and other government-backed programs.
In November, the Department of Justice announced indictments related to an alleged Los Angeles fraud ring. Prosecutors said defendants used fake, stolen, or synthetic identities as part of a scheme to seek COVID-19 relief through the Small Business Administration's Economic Injury Disaster Loan program and the PPP.
In August, federal prosecutors in Florida
Yet the Fed has noted challenges in tracking synthetic identity fraud because in some cases it is hard to tell it apart from more standard identity theft.
"It is often difficult to differentiate synthetic identity payments fraud from traditional identity payments fraud and legitimate financial activities," the Fed said in a July 2019 paper. "As a result, subject matter experts indicate that the number and volume of synthetic identities in financial portfolios are underestimated."
A paper released last year discussed the advantages of developing a common definition for synthetic identity fraud.
"We recently spoke with a credit union about its machine learning tool developed for fraud detection. In beta tests, the tool flagged approximately 85% of credit applications originating from synthetic identities," the paper said. "While this demonstrates that detection models can successfully be adapted to synthetics, fraud industry experts advise that these detection models could be improved if they utilize a standard definition of synthetic identity fraud. This would allow for broader comparison and analysis of the data and results."
Now that the Fed's working group has developed a standard definition, the next phase is to get the word out, observers said.
“It's just a starting point for the Fed, from what I'm hearing and they've certainly reached back out to us to say, [the] next step is kind of bringing this to market so they can get that consistency,” said Woolf.
The Fed is currently undertaking new work to offer educational materials to the banking industry that firms can use both to educate employees and identify synthetic identity fraud in their own portfolios, said Timoney.
“We're really trying to bring together a series of materials that can help educate the industry and help protect the industry, and that's something we've just kicked off,” he said, adding that the Fed hopes to ultimately put together a package later this year to “help the industry fight synthetic" identity fraud.
In addition to exposing banks to credit losses, Timoney said synthetic identity fraud can also pose reputational risks for firms as well, especially if fraudsters are using synthetic identities to engage in other illegal activities.
“Anytime a bank has accounts on their books that are being used for illegal purposes, there's a potential for a reputational impact there,” he said.
Kratovil hopes that as part of its work on synthetic identity fraud, the Fed can also help to raise awareness of a new system the Social Security Administration is building
The SSA has long had a system that has allowed financial institutions to verify social security numbers, but that system is less useful for synthetic identity theft since fraudsters use existing social security numbers to open accounts.
The 2018 law required the agency to update the system to perform real-time checks of a customer’s social security number, name and date of birth, which Kratovil argues could be useful in combating synthetic identity fraud.
“As the industry has digitized, the SSA's original paper-based system to verify SSNs and help combat synthetic identity fraud did not,” he said. “I think an important role that the Fed can play is raising awareness of the system that SSA is building.”
At the same time, the Fed has to be sure that its work on synthetic identity fraud doesn’t have the counterproductive effect of arming bad actors with information that could help them evade detection, said Kratovil.
“You can't give away trade secrets that would give fraudsters a peek inside the tent, but you can certainly help arm financial institutions with the knowledge and strategies to help them begin to identify and combat synthetic identity fraud in their own houses,” he said.
While he believes the Fed has made progress since it began its work on synthetic identity fraud in 2018, there is a recognition that the work is only just beginning, Timoney said.
“Even though I think we've made huge strides, I think there's a lot more work to be done,” he said. “That's why we're going to keep doing what we're doing to try and make sure people are aware of it.”
